App Store age verification: Texas, Utah, Brazil

In Texas, since June 4, 2026, the App Store verifies the age of new accounts and passes their age category to your app when it asks for it through the Declared Age Range API. Where a law requires it, it's up to you to read that category, ask for a parent's consent before a significant change, and handle the withdrawal of that consent. Brazil, Utah, Louisiana and Alabama each have their own timeline, and the App Store already blocks 18+ apps in Australia, Brazil and Singapore for anyone not confirmed as an adult.

I publish my own iOS apps with Expo, including Solys and TradaZen. Here I pull together, territory by territory, what Apple and the official texts say, then the sequence you need to code. This guide isn't legal advice: Apple itself sends you to your lawyer for your obligations. To pick your rating from 4+ to 18+, read age ratings in App Store Connect instead.

What age verification changes for you

According to Apple's age assurance FAQ, "developers are responsible for their own age restrictions." Where the law requires it, Apple confirms the account holder's age and shares their age category with you. In those regions, you have to verify the age of the people using your app.

Three things change:

• You get an age range, never an exact age. Apple tells you, for example, "13 to 15," and how that range was established.
• A significant change to your app may require a parent's consent. You decide what counts as significant, based on the applicable law.
• A parent can withdraw consent. Apple then stops the app from opening on the child's device, and your server gets a RESCIND_CONSENT notification if you've set it up.

What doesn't change: per the same FAQ, "there are no changes to the App Review process." Existing accounts on iOS 18 or earlier aren't affected. The API itself works worldwide: outside regulated regions, the user chooses whether or not to share their range.

Review doesn't change for these laws. Apple passes you the age, and it's the law that asks you to use it.

Texas: SB 2420 has applied since June 4, 2026

Texas law SB 2420, known as the App Store Accountability Act (section 121.001), was supposed to take effect on January 1, 2026, according to its enrolled text. On December 23, 2025, Apple announced that a district court injunction had blocked it. Apple paused its plans and kept its tools in sandbox.

On June 3, 2026, Apple announced that a court decision had lifted the injunction: the federal Fifth Circuit Court of Appeals stayed it pending appeal. Since June 4, 2026, new Apple accounts in Texas are subject to the law. On July 6, 2026, the US Supreme Court declined to lift that stay (docket 25A1390). That's an emergency ruling, not a decision on the merits. As of October 27, 2026, I haven't found any appellate ruling on the merits: the law applies, but things can still change.

What the App Store does in Texas

For every new account in Texas, the App Store verifies age. For a minor under 18, it also asks for a parent's consent for three actions: downloading the app, making an in-app purchase, and accessing a significant change. The parent can withdraw consent for any app already approved.

In its November 4, 2025 note, Apple lays out the law's four categories: under 13, 13 to 15, 16 and 17, 18 and over. Apple also warns that the law could force the collection of sensitive data "just to download an app," even for a weather app. The text targets any developer whose app is available in Texas through a store (section 121.051): a simple app isn't out of scope.

What the law asks of developers

SB 2420 gives you four obligations:

1. Verify age using the store's data (section 121.054): each user's category and, for a minor, whether parental consent exists.
2. Use that data only for age purposes (section 121.055): restrictions, legal compliance, safety settings. You delete it once verification is done.
3. Notify the store before any significant change to your terms of use or your privacy policy (section 121.053).
4. Assign an age rating to the app and to every purchase available in it (section 121.052). On the App Store, the app's rating comes from the App Store Connect questionnaire.

The law considers a change significant if it alters the data collected or shared, affects the age rating, adds a purchase or ads, or materially changes features or the experience. Apple adds that Texas treats an age rating change as a significant change.

Utah, Louisiana, Alabama: laws for 2027

Apple's February 24, 2026 note set two dates. For new accounts, the API was supposed to pass the age category in Utah starting May 6, 2026, and in Louisiana starting July 1, 2026. New signals tell you whether age rules apply to the user, whether they have to share their range, and whether a parent has to approve a significant change. Adults in those states may get a significant change notification: Apple then asks you for a clear description of the change.

Since then, both laws have been amended:

• Utah: H.B. 498 amends the 2025 App Store Accountability Act (S.B. 142). According to its enrolled text, obligations for stores and developers start May 6, 2027. The definition of a significant change gets narrower: a change to the terms or privacy policy that alters the data collected or the age rating, or adds a first in-app purchase or first ads.
• Louisiana: HB 977, signed May 15, 2026, became Act 185. It keeps the 2025 law (HB 570, which became Act 481) from taking effect and replaces it with new rules, applicable July 1, 2027.

Both texts ask developers to verify the age category through the store's tools and to notify the store of a significant change. Utah bans sharing that data, Louisiana bans selling it.

Alabama follows the same model. Its HB 161, signed February 17, 2026 and now Act 2026-59, applies January 1, 2027, according to its enrolled text. Developers verify the age category and parental consent through the store's tools, notify it of any significant change, and use that data only for age, legal and safety purposes.

As of October 27, 2026, Apple hasn't published any note on the Utah and Louisiana delays, or on Alabama: check what the API actually returns for your users in those states. My take: the tools are ready before the obligation, so use these months to code and test.

Brazil: ECA Digital in force since March 17, 2026

The Digital Statute of Children and Adolescents, ECA Digital, is Law No. 15.211 of September 17, 2025. Its article 41-A puts it into force on March 17, 2026. Three articles concern you:

• Article 12: stores and operating systems determine the age or age range and pass an age signal to apps through an API. A download by a child or adolescent requires a parent's free and informed consent.
• Article 13: age verification data is used only for that.
• Article 14: an app aimed at children and adolescents, or likely to be used by them, must be able to receive that signal. It keeps its own mechanisms to block inappropriate content, whatever the store does.

On Apple's side, the age category is shared when the user, or a parent, agrees. An app that declares paid loot boxes in the questionnaire becomes 18+ on the Brazilian storefront. If you offer alternative payments in Brazil, Apple's page on distribution in Brazil asks you to put them behind a parental gate for users under 18, without offering them purchases on a website. The commissions and steps for that option are in the guide on alternative payments in Brazil.

The law hands enforcement to an autonomous administrative authority. Implementing decrees and guidance from that authority, cited by law firms, spell it out further: I haven't read them in their official text. Have a Brazilian lawyer check them before you adapt your app.

Australia and Singapore: 18+ apps blocked

Since February 24, 2026, the App Store in Australia, Brazil and Singapore blocks downloads of 18+ apps until the user has been confirmed as an adult. The App Store does this check automatically. Apple notes that you may have your own obligations to verify your users are adults, and that the API sends you a signal to help. Apple doesn't name the laws involved.

Australia adds two rules announced by Apple:

• Social media: since December 10, 2025, certain social platforms must keep users under 16 from having an account. The developers concerned deactivate existing under-16 accounts and monitor sign-ups.
• Age ratings: since June 18, 2026, the 15+ rating is gone in Australia. 15+ apps with unrestricted web access, frequent medical information or paid loot boxes move to 16+. You set your rating in the age questionnaire.

For Singapore, Apple hasn't announced anything beyond blocking 18+ apps.

The table: what applies, from when, and what you do

This table sums up the previous sections, as of October 27, 2026. "Apple" gives the date the App Store applies the rule, "law" the date of the text's obligations.

Territory	Date	The App Store	What you do
Texas	June 4, 2026	Verifies age, parental consent	Range, consent, withdrawal
Utah	Law May 6, 2027	Category announced for 2026	Code before May 6, 2027
Louisiana	Law July 1, 2027	Category announced for 2026	Code before July 1, 2027
Alabama	Law Jan. 1, 2027	Nothing announced	Code before Jan. 1, 2027
Brazil	Apple Feb. 24, 2026, law March 17, 2026	Category if consent, 18+ blocked	Read the signal, filter
Australia	February 24, 2026	18+ blocked	Social: no users under 16
Singapore	February 24, 2026	18+ blocked	Check your obligations

What you need to code: the five-step sequence

According to Apple's FAQ, you need to build with the iOS 26.2 and iPadOS 26.2 SDKs or later, using Xcode 26.2 (17C52) or later. Then enable the Declared Age Range capability on your target: it adds the com.apple.developer.declared-age-range entitlement, required by the API documentation.

1. Find out whether a law applies to this user. Since iOS 26.4, requiredRegulatoryFeatures returns the active rules: declaredAgeRangeRequired, significantAppChangeRequiresParentalConsent, significantAppChangeRequiresAdultNotification. On iOS 26.2, isEligibleForAgeFeatures already tells you whether the user falls under age-related features.
2. Request the age range. requestAgeRange(ageGates:_:_:in:) takes up to three age thresholds, for example 13, 16 and 18 to match the laws' categories. Where the law sets its own thresholds, the response follows the law rather than yours. The response is .sharing(range:) or .declinedSharing. The range contains lowerBound, upperBound and ageRangeDeclaration: declared by the user, by a parent, or confirmed.
3. Handle significant changes. For a minor, PermissionKit and SignificantAppUpdateTopic ask for the parent's consent, and the parent reads your description. Until they approve, you block the new feature, or even the whole app. For an adult, since iOS 26.4, showSignificantUpdateAcknowledgment(in:updateDescription:) shows a system sheet. The StoreKit property ageRatingCode gives the current age rating on the device: compare it to spot a change.
4. Listen for consent withdrawal. Enable App Store Server Notifications version 2 and handle the RESCIND_CONSENT type. Apple already blocks the app. On the server side, it's up to you to act on the withdrawal, for example by suspending the account's access. If your notifications go through RevenueCat, it can forward them to your server. Its page doesn't mention this type: check in sandbox that it actually arrives.
5. Test in sandbox. Turn on Developer Mode, open Settings, then Developer. Under your sandbox Apple account, choose Manage, then Age Assurance or Revoke App Consent, per the English labels in Apple's docs. Apple's testing page offers six scenarios, from "under 13, change approved" to "18 and over, age confirmed, change applicable." The consent withdrawal menu takes your bundle identifier and triggers RESCIND_CONSENT on your server.

Here's a Swift sketch, written from the signatures in Apple's documentation, to adapt to your app:

import DeclaredAgeRange
import UIKit

@available(iOS 26.4, *)
func lireTrancheAge(depuis vc: UIViewController) async throws {
    let service = AgeRangeService.shared
    let regles = try await service.requiredRegulatoryFeatures
    guard regles.contains(.declaredAgeRangeRequired) else { return }

    let reponse = try await service.requestAgeRange(ageGates: 13, 16, 18, in: vc)
    if case .sharing(let tranche) = reponse {
        // tranche.lowerBound, tranche.upperBound, tranche.ageRangeDeclaration
    }
}

In sandbox, for an adult, PermissionKit throws the AskError.notAvailable error instead of returning a response: that's expected, since an adult doesn't need parental consent.

With Expo or React Native

Expo publishes the expo-age-range module. Its docs, reread on October 27, 2026, expose requestAgeRangeAsync, isEligibleForAgeFeaturesAsync (iOS 26.2), getRequiredRegulatoryFeaturesAsync and showSignificantUpdateAcknowledgmentAsync (iOS 26.4). You declare the entitlement in ios.entitlements in your Expo config.

Two limits to know about:

• Before iOS 26, the module returns lowerBound: 18, as it would for an adult. Don't treat that response as a verification.
• Expo's docs don't mention PermissionKit or ageRatingCode. To ask for a parent's consent, plan for a native module, or reread the docs before coding. RESCIND_CONSENT is handled server-side, outside the app.

The module is native: it needs a new build, not an OTA update. The process is the same as publishing an Expo app to the App Store with EAS.

You publish from France: does this apply to you?

Apple's FAQ says nothing about the country where the developer is based. For any compliance question, it sends you to your legal counsel. The Texas text targets developers who make their app available in Texas through a store (section 121.051). The Utah and Louisiana texts define a developer as whoever owns or controls an app available in the state, with no location condition.

My take: if your app is available in one of these territories, assume the rules apply to you. You can't exclude Texas alone, since availability is set country by country in App Store Connect. Pulling the US or Brazil to dodge the issue would cut you off from two big markets.

On the data side, the age range is still personal data, and the Texas, Utah, Alabama and Brazil texts limit its use to age purposes. Apple's Developer Program License Agreement adds its own rule (section 3.3.3(O)): the API is for adapting your app to age or complying with the law, and its data can't be sold or shared with data brokers. Treat it under the collection rules of guideline 5.1.1, and reread the data sharing rules of guideline 5.1.2: the laws come on top of those.

My checklist before your next update

1. List the territories where your app is available: US, Brazil, Australia, Singapore.
2. Build with Xcode 26.2 or later and enable the Declared Age Range capability.
3. Call requiredRegulatoryFeatures, then requestAgeRange with thresholds at 13, 16 and 18.
4. Write down what counts as a significant change for your app, and have a lawyer sign off on it.
5. Wire up the parental consent request (PermissionKit) and the sheet for adults.
6. Enable version 2 server notifications and handle RESCIND_CONSENT.
7. Run the six sandbox scenarios and a consent withdrawal.
8. Check your answers to the age questionnaire: paid loot boxes move to 18+ in Brazil, and a social network closed to under-13s requires you to use the API.

What I checked, and when

Reviewed October 27, 2026. The dates and obligations come from Apple Developer notes, its FAQ, its documentation, its developer license and its review rules, the enrolled text of each law (Texas, Utah, Louisiana, Alabama, Brazil) and the Supreme Court docket. This guide isn't based on any integration in my apps: the code is a sketch drawn from Apple's signatures, not a tested integration. The Brazilian decrees, the Australian and Singaporean laws, and the laws of other US states haven't been read.

Frequently asked questions

What is the Declared Age Range API?

It's Apple's API that requests the user's age range, available worldwide since iOS 26. Where the law requires it, Apple confirms the account's age and passes along its category. Elsewhere, the user chooses whether to share it.

Does an 18+ app have to use the API?

Yes. Apple's FAQ says so: in regions where the law requires it, you have to verify your users' age with the API, even for an 18+ app. The App Store's blocking in Australia, Brazil and Singapore doesn't replace your own obligations.

Can Apple reject my app if I don't use the API?

According to Apple's FAQ, the App Review process doesn't change for these laws. The obligation comes from the territory's law, not from review. Still, three Apple rules already require an age check. If you declare a social network closed to under-13s, the Time Allowances announcement requires you to at least use the API. The review guidelines ask creator apps (1.2.1) and apps offering mini apps, mini games or chatbots (4.7.5) to restrict access based on verified or declared age. And guideline 2.3.6 still requires you to answer the age questionnaire honestly.

What counts as a significant change for Apple?

Apple leaves it up to you, based on the applicable law, and refers you to your lawyer. The Texas text lists a change to the data collected, the age rating, purchases, ads, or a material change in features. Utah's amended text and Alabama's don't include that last point; Louisiana's keeps it.

What happens when a parent withdraws consent?

Apple stops the app from opening on the child's device. Your server gets a RESCIND_CONSENT notification, if you've enabled App Store Server Notifications version 2.

Does the Texas law apply to a French developer?

Apple doesn't decide and refers you to your legal counsel. The Texas text targets developers who make their app available in Texas through a store, without mentioning their country. My take: if your app is available in the US, it's available in Texas, so act as if the law applies to you.

How do I test age verification without a minor account?

In sandbox, since iOS 26.2. In Settings, then Developer, your sandbox Apple account offers ready-made age scenarios and a simulated consent withdrawal for your bundle identifier.

Sources

• Age assurance frameworks Q&A, Apple Developer FAQ.
• Apple Developer notes: November 4, 2025, December 8, 2025, December 23, 2025, February 24, 2026, May 21, 2026, June 3, 2026 and June 8, 2026.
• Laws: Texas SB 2420, Utah H.B. 498, Louisiana Act 185, Alabama HB 161, Brazil, Law No. 15.211.
• Apple rules: App Review Guidelines, Developer Program License Agreement.
• Supreme Court docket, 25A1390.
• Apple documentation: Declared Age Range, sandbox testing, server notification types.
• expo-age-range, Expo documentation.

Before your next update

Before you submit your next version, take the free diagnostic: it tells you what's really blocking your project and sends you my Apple anti-rejection checklist.

The Apple Review Kit bundles my pre-submission checklist, my fixed rejections and two Claude Code skills that review your project and your listing, then draft your reply if Apple rejects you. The full process is on the app rejected by Apple page.